--- a/accessible/src/xul/nsXULTreeAccessible.cpp
+++ b/accessible/src/xul/nsXULTreeAccessible.cpp
@@ -710,16 +710,27 @@ nsXULTreeitemAccessible::GetState(PRUint
   NS_ENSURE_ARG_POINTER(aState);
 
   *aState = 0;
   if (aExtraState)
     *aExtraState = 0;
 
   NS_ENSURE_TRUE(mColumn && mTree && mTreeView, NS_ERROR_FAILURE);
 
+  PRInt32 rowCount = 0;
+  rv = mTreeView->GetRowCount(&rowCount);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (mRow < 0 || mRow >= rowCount) {
+    if (aExtraState)
+      *aExtraState = nsIAccessibleStates::EXT_STATE_DEFUNCT;
+
+    return NS_OK;
+  }
+
   *aState = nsIAccessibleStates::STATE_FOCUSABLE |
             nsIAccessibleStates::STATE_SELECTABLE;
 
   // get expanded/collapsed state
   if (IsExpandable()) {
     PRBool isContainerOpen;
     mTreeView->IsContainerOpen(mRow, &isContainerOpen);
     *aState |= isContainerOpen? PRUint32(nsIAccessibleStates::STATE_EXPANDED):